Twenty-five years ago the Piper Alpha disaster changed the oil and gas landscape but have the safety lessons been learnt?
It is 25 years since tragedy struck in the North Sea. One hundred and sixty seven people died in the Piper Alpha fire on 6 July 1988, making it the world's worst offshore oil disaster. The majority of the victims suffocated in toxic fumes that developed after a gas leak set off the blasts and sparked the fire.
Two years later Lord Cullen's report into the disaster severely criticised safety procedures on the rig owned by Occidental Oil. Although no individuals were blamed at the time, a later civil action over insurance payments in 1997 pointed the finger at two workers who died in the disaster.
However, that finding has been contested both by relatives of the men concerned and television documentary investigations.
Lessons were taken on board, but are these lessons still at the heart of oil and gas management culture? Recent evidence would suggest that they aren't and that possibly companies still give too much credence to personal safety issues rather than looking at the bigger picture of process safety.
Lord Cullen admits to initially being slightly overwhelmed by the scope of the enquiry. "What was I to investigate?" he says. "In the second part of my remit I was asked to make observations and recommendations with a view to the preservation of lives and the avoidance of similar accidents in the future. I asked myself which subjects I should investigate and how far should I pursue them?"
Major accidents may have catastrophic consequences, but such events are rare; history does not repeat itself in exactly the same fashion. So Lord Cullen decided that it didn't make sense to take a narrow view on the implications of the disaster for the future of offshore safety. "I was also very conscious of the deadly and profound effect of the disaster; the unthinkable had happened and a great shock had run through the industry.
"Before I got to grips with the enquiry I assumed it would be to do with hardware, and to some extent it was, for instance subsea isolation valves that were lacking in the case of Piper Alpha. But I quickly realised that fundamentally, and running through everything, was the management of safety. As I dug down into the background of what happened I discovered that it was not just a matter of technical or human failure. As is often the case, such failures are indicators of weaknesses in the management of safety."
In the case of Piper Alpha management, shortcomings emerged in a variety of forms; for example there was no clear procedure for shift handovers, the permit-to-work system was inadequate and had been habitually departed from, training, monitoring and auditing had been poor, and the lessons of a previous, relevant accident had not been followed through.
Evacuation procedures had not been practiced properly and there had not been adequate assessment of the potential of major hazards or methods of controlling them. A glaring example was the risk of a high pressure gas fire, the consequences of which would be grave for the structural integrity of the platform, for the safety of personnel and for the means of evacuation and escape. The gas pipelines would take hours to depressurise and this became a dreadful reality on the night of the disaster.
"These and other examples were starting points for possible recommendations to industry and changes to the regulations," Lord Cullen adds. "At the same time I was conscious, as I said in my report, that no amount of regulations for safety improvements can make up for deficiencies in the way that safety is actually managed. The quality of management safety is fundamental and that depends critically on safe leadership at all levels and the commitment of the workforce to give priority to safety. I saw those factors as intertwined and part of a positive learning culture."
The shortcomings on Piper represented failures on the part of management to give adequate attention to process safety; that is safety from major hazards where the frequency of realisation is low but the potential consequences are very serious. The regulation and recommendations from Lord Cullen's report should have prevented further tragedies, but history recounts differently. Later accidents elsewhere in the world provide further examples, beginning with the onshore industry.
In 2005 an overflow of petrol at the storage plant at Buncefield, England, led to the ignition of a vapour cloud and a massive explosion and fire. A monitoring gauge had been sticking for months and a high level switch for closing down the flow was inoperable. Because of a lack of communication this had not been locked in a working position. Fuel bunds were inadequately designed and maintained.
A report by the Strategic Management Group stated that various pressures had created a culture where keeping the process operating was the primary focus and that process safety did not get the attention, resources or priority that it required. The safety management system focused too closely on personal safety and lacked any real depth about the control of major hazards.
In that same year BP's Texas City refinery was the scene of a disaster when a release of flammable liquid caused an explosion and fire. The United States Chemical Safety and Hazard Investigation Board said that it was caused by organisational and safety deficiencies at all levels of the corporation – cost cutting, failure to invest and production pressures had imparted process safety performance.
They also said that reliance on a low personal injury rate as a safety indicator had failed to present a true picture of process safety performance and the health of a safety culture. Former US Secretary of State James Baker III headed a panel that investigated the culture and managements at BP's US refineries. Its report said: "BP emphasised personal safety, but not process safety and did not set an appropriate process safety tone at the top or establish appropriate goals and expectations about process safety performance."
Five years later came Macondo and a report by the Deepwater Horizon Study Group by members of the Centre for Catastrophic Risk Management. Their findings were strikingly similar to those recorded by Baker. They said, for example, "BP's organisations and operating teams did not possess a functioning safety culture. Their system was not propelled towards the goal of managing maximum safety in all its manifestations but was rather geared towards a trip and fall compliance mentality rather than being focused on the big picture". It has been observed that the BP system forgot to be afraid.
Health and safety
One of the key changes following Lord Cullen's report was moving regulatory control for the offshore industry into the hands of the Health and Safety Executive. Current chair Judith Hackitt is in no doubt that the changes that were made to the offshore operating regime after the tragic events of 1988 have had a lasting impact on how we all work today and particularly of the safety case being at the heart of all our work.
"The key question is not only about what we have learnt but what we have done with that learning," she says. "Have we embedded learning into what we do today, every day and in the future?
"There are some key principles that I am confident most of us will agree with. The principle that offshore legislation should be goal-setting rather than proscriptive, operators should be responsible for managing the risks that go with offshore installations, operators of offshore installations should proactively demonstrate to the regulators that all major accident risks have been assessed and measures taken to control those risks. And also the principle that regulators, operators and contractors should support, encourage and welcome the involvement of the offshore workforce in offshore safety."
Hackitt continues: "The key question for me is how we stay true to those abiding principles introduced by Lord Cullen, but in a world that is substantially different to that of 1988 and which continues to change and develop at an ever faster pace. Maintaining continuity of those things from the past, which still hold true, but needing to adapt to the ever changing environment will be the key to a successful and safe North Sea."
There are many challenges facing the oil and gas sector. Prime among these is the growing base of ageing assets; many installations are operating beyond their design life. Contrast this with numerous new assets and new techniques being deployed. Drilling is taking place in ever deeper water and in more hostile environments.
Technology has developed to enable enhanced oil recovery and there has been a significant increase in the number of smaller operators entering the sector, as well as the outsourcing of operations. The demographics of the offshore workforce continue to change. Workforces will disperse around the globe when they come ashore; crews are more mobile and multi-cultural.
"Knowledge and experience is being built up around the world," Hackitt says. "But how good are we and how good are the mechanisms that are in place to share that knowledge? Events which have taken place since Piper point to significant shortcomings and gaps which still need to be filled."
It is also important to recognise the broader context in which oil and gas companies operate. Attitudes to both safety and environmental protection have changed. There is significantly lower tolerance of failure among government and public alike. The rapidly changing economic and financial environment is a key driver of investment decisions. Other technological developments can and will impact on offshore operations.
It's all about people
"As an offshore worker you were always aware that you worked in a dangerous environment but I don't think many really understood just how dangerous it was," says Jake Molloy, regional organiser, National Union of Rail, Maritime and Transport Workers. "At the time of the Piper Alpha incident the workforce lived in a world where cutting-edge technology was a fax machine, so the first that those working offshore knew of the incident was through newspapers.
"The headlines kept coming, as did the funerals and memorial services. Along with the horror stories and deaths of 167 of our colleagues came the PR people and political apologists who looked to defend the operators and the contractors. They tried to put together a story fit for public consumption, arguing that the Piper catastrophe was unforeseen and unforeseeable," adds Molloy.
"The workforce knew differently. Slowly the alternative workforce opinion emerged. Intense media interest ensured that each and every successive incident, near miss and safety scandal was instantly relayed to an increasingly outraged public. What was exposed, in our opinion, was a rotten safety regime being overseen by a government department whose core function was to ensure uninterrupted production."
A little more than six months after Piper, thousands of offshore workers took the campaign for safety improvements onto the streets. Marches took place in Aberdeen, Glasgow, Newcastle, Liverpool and many other places around the country. Industrial action followed and it was dramatic, hitting the national stage as few had done since the miner's strike in 1984.
"Commentary by the national opinion formers, such as 'Panorama', 'Newsnight' and others, suggested the workers under the banner of OILC won the media war," Molloy adds. "At the heart of these disputes and campaigns were thousands of courageous and principled offshore workers who put their livelihood on the line in pursuit of fairness, justice and a safer workplace.
"Later, as we all know, Lord Cullen worked his magic and produced the two tablets of 106 commandments, which we know today as the public enquiry of the Piper Alpha disaster. These volumes were the prelude to a whole raft of regulations, which prevail today and have, for the most part, kept workers safe.
"However, the regulations on their own would never have delivered without the presence of a regulatory authority in the form of the Offshore Safety Division of the HSE, coupled with the ever-present challenge of organisations like my own. It is important to note that the challenges posed by us, as workers and representatives, have been challenges to both industry and the regulator."
Molloy believes that challenge is vital because we have come close to disaster a number of times over the last 25 years, closer than some can ever imagine. Too often luck, as opposed to good management, has been the only thing saving us from another disaster. "These events have determined some of our biggest challenges," Molloy says. "We believe as workers that the fundamentals of those challenges are captured in the key programmes run by the Offshore Safety Division over the course of the last 12 years."
Key Programme One was launched in 2001 and was reducing offshore hydrocarbon leaks; there were simply too many releases occurring and the HSE wanted industry to address this. "The initiative has delivered significant improvement but the workers have been shouting about gas leaks for some time," Molloy adds.
Key Programme Two was deck lifting and drilling operations, initiated in response to accident statistics in the industry that saw eight drilling-orientated fatalities in a three-year period.
"This programme was launched in 2003, not long after my trade union had supported the family of a worker killed and represented them at a fatal accident enquiry," Molloy continues. "Additionally, the use of a lagging indicator and specifically one that counts bodies was completely unpalatable. Workers were outraged at the lack of improvement in drilling operations."
The effect of that initiative is evident today; there has not been a death in drilling operations in the UK sector since 2004. Key Programme Three was launched in 2004 and was an HSE resource.
The most recent example of the oil and gas industries failing to walk the talk came when 11 workers lost their lives when Deepwater Horizon exploded and sunk in the Gulf of Mexico.
"In many cases we have been lucky," says Thad W Allen, executive vice president, technology consulting firm Booz Allen Hamilton. "What if you aren't lucky? What if you have a low probability, high consequence outcome?
"I have been involved in oil spills for over 20 years, purely from a response standpoint, but on 20 April 2010 we had just celebrated my wife's birthday and I was asleep when I was called by our command centre who told me that there had been an explosion on a deep-water oil rig in the Gulf of Mexico. At that point is was a conflagration and we were attempting to rescue people. We launched a massive search and rescue operation that lasted over 48 hours and covered 35,000 square miles, but unfortunately 11 people lost their lives. A small number to those who lost their lives on Piper Alpha, but any loss of life is tragic and unacceptable.
"Was it preventable? Yes! Was the industry prepared? No! Was government prepared? I led the government response so I can tell you no. We were fixated in preventing another tanker accident after Exxon Valdez and our regulatory efforts had focused on that while technology had allowed drilling to move offshore. We had separated the process of a rig standing over a well in shallow water to a well-head operation connected by a riser pipe to a ship regulated by international safety standards, all while we were looking at response plans for a tanker emergency."
The responses needed technology that wasn't in the Gulf of Mexico. Within 87 days of the explosion a capping stack had to be designed, tested, built, deployed and put on the well head. In the meantime, in an effort to avert the massive amount of oil coming to the surface, a catchment strategy was instigated to contain the 60-80,000 barrels a day gushing from the well on the seabed.
"There was also a total lack of information surrounding the condition of the well bore, the low out preventer and the reservoir itself," Allen explains. "Every step along the way that we took we had to take into account this lack of information.
"Finally, we were dealing with a point of discharge that had no human access. All the images came from ROVs beamed back to BP's control centre - The Hive. I have told people since then that this was closer to Apollo 13 than Exxon Valdez in terms of having to manage systems without human eyes on the scene."
Regulations may have improved but if further disasters are to be avoided safety must evolve from an incident counting culture to placing process safety at the core of management culture.